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Executive Order (E.O.) 13526, "Classified National Security Information," E.O. 
12829, as amended, "National Industrial Security Program," and E.O. 13549, 
"Classified National Security Information Program for State, Local, Tribal, and 
Private Sector Entities." The Information Security Oversight Office (ISOO) is a 
component of the National Archives and Records Administration (NARA) and 
receives its policy and program guidance from the National Security Advisor. 

ISOO oversees the security classification programs in both Government and 
industry and reports annually to the President on their status. 

» Develops implementing directives and instructions. 

» Reviews and approves agency implementing regulations. 

» Maintains liaison relationships with agency counterparts and conducts on- 
site and document reviews to monitor agency compliance. 

» Develops and disseminates security education materials for Government 
and industry; monitors security education and training programs. 

» Receives and takes action on complaints, appeals, and suggestions. 

» Collects and analyzes relevant statistical data and, along with other 
information, reports them annually to the President. 

» Serves as spokesperson to Congress, the media, special interest groups, 
professional organizations, and the public. 

» Conducts special studies on identified or potential problem areas and 
develops remedial approaches for program improvement. 

» Recommends policy changes to the President through the National 
Security Advisor. 

» Provides program and administrative support for the Interagency Security 
Classification Appeals Panel (ISCAP). 

» Provides program and administrative support for the Public Interest 
Declassification Board (PIDB). 

» Reviews requests for original classification authority from agencies. 

» Chairs the National Industrial Security Program Policy Advisory Committee 
under E.O. 12829, as amended. 

» Chairs the State, Local, Tribal, and Private Sector Policy Advisory Committee 
under E.O. 13549. 

» Promotes and enhances the system that protects the national security 
information that safeguards the American people and their Government. 

» Provides for an informed American public by ensuring that the minimum 
information necessary to the interest of national security is classified and 
that information is declassified as soon as it no longer requires protection. 

» Promotes and enhances concepts that facilitate the sharing of information in 
the fulfillment of mission-critical functions related to national security. 

» Provides expert advice and guidance pertinent to the principles of 
information security. 



Letter to 
the President 



April 15, 2011 



The President 
The White House 
Washington, DC 20500 

Dear Mr. President: 

I am pleased to submit the Information Security Oversight Office's (ISOO) Report to the President for 
Fiscal Year (FY) 2010. 

This report provides information on the status of the security classification program as required by 
Executive Order 13526, "Classified National Security Information" (the Order). It provides statistics and 
analysis concerning key components of the system, primarily classification and declassification, and 
coverage of ISOO's reviews. It also contains information with respect to industrial security in the private 
sector as required by Executive Order 12829, as amended, "National Industrial Security Program." 

FY 2010 was a notable year for the security classification program. The initial implementation of 
Executive Order 13526 began in earnest and remains ongoing. To comply with your direction that a 
government-wide implementing directive be issued within 180 days, we led an interagency working group 
that developed 32 C.F.R. Part 2001 which became effective and binding on all appropriate Executive 
branch agencies on June 25, 2010. 

However, we are concerned about delays in the issuance of agency regulations implementing the Order. 
Despite the preparation of agency drafts and the completion of our review last Fall, many agencies failed to 
issue their regulations in final form by December 2010 and many have yet to issue them as of the date of 
this letter. Regardless, we believe that the implementation of the Order is actually more advanced than it 
has been in the past following the issuance of major revisions of policy in this area and that the foundation 
being built is strong. We will continue to monitor agency progress, with a special focus on implementing 
regulations, security education and training programs, self-inspection programs, and measures designed 
to hold personnel accountable. 

FY 2010 also saw the issuance of Executive Order 13549, "Classified National Security Information 
Program for State, Local, Tribal, and Private Sector Entities." In response to this, we established the 
State, Local, Tribal, and Private Sector (SLTPS) Entities-Policy Advisory Committee (PAC) which is now 
operational and providing valuable advice to the implementation process. 



Respectfully, 




William A. Cira 
Acting Director 
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Summary of fy 2010 
Program activity 



Classification 

» Executive branch agencies 
reported 2,378 original 
classification authorities 
(OCA), a 7 percent reduction 
from FY 2009 and the lowest 
number reported to date. 

» Agencies reported 224,734 
original classification decisions. 

» Agencies reported using the 
ten-years-or-less declassifica- 
tion instruction for 74 percent 
of original classification 
decisions, the highest percent- 
age of use to date. 

» Executive branch agencies 
reported 76,571,211 derivative 
classification decisions; a 
40 percent increase from 
FY 2009. This is an expected 
increase due to revised 
reporting requirements 
intended to better capture 
classification activity in the 
electronic environment. 

» Twenty-five percent of the 
classification guides reported 
as being currently in use had 
not been updated within the 
past five years as required, 
an improvement over last 
year's reported number of 
forty-six percent. 

Declassification 

» Under automatic declas- 
sification, agencies reviewed 
45,386,491 pages and declas- 
sified 24,238,273 pages of 
historically valuable records. 




» Under systematic 

declassification reviews, 
agencies reviewed 5,797,022 
pages, and declassified 
4,630,410 pages. 

» Under discretionary declas- 
sification reviews, agencies 
reviewed 1,903,832 pages, and 
declassified 181,607 pages. 

» A total of 53,087,345 pages 
were reviewed for declassifica- 
tion and 29,050,290 pages 
were declassified. 

» Agencies received 9,686 initial 
mandatory declassification 
review (MDR) requests. 

» Agencies reviewed 331,782 



pages under MDR, and 
declassified 213,425 pages 
in their entirety, declassified 
96,268 pages in part, and re- 
tained classification of 22,089 
pages in their entirety. 

» Agencies reported carrying 
over 9,542 initial MDR 
requests into FY 2011. 

» Agencies received 
302 MDR appeals and 
processed 231 appeals. 

» Agencies reviewed 3,330 pages 
on appeal, and declassified 
1,308 pages in their entirety, 
declassified 1,057 pages in part, 
and retained classification of 
965 pages in their entirety. 
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Agency implementation of 

E.O. 13526 



ISOO has stressed to the remaining agencies the 
importance of updated regulations, which serve 
as the foundation for the classification system. 



n December 29, 2009 
President Obama issued 
a Memorandum for the Heads 
of Executive Departments and 
Agencies entitled "Implementation 
of the Executive Order, "Classified 
National Security Information." 

In this memorandum, the 
President said he expects personal 
commitment from the heads of 
departments and agencies, as 
well as their senior officials. He 
also stressed the importance of 
effective security education and 
training programs, self-inspection 
programs, and measures designed 
to hold personnel accountable. 

The memorandum also directed 
all heads of departments and 
agencies to conduct a review 
to ensure that all delegations of 
original classification authority are 
limited to the minimum necessary 
to implement the Order and 
that only those individuals with 
a demonstrable and continuing 
need to exercise such authority 
shall have it. In following up on this 
requirement, ISOO determined 
that all agencies had completed 
this review. Data received from the 
agencies revealed a seven percent 
reduction in the number of officials 
with original classification authority. 

The President's memorandum 
also directed all agencies that 
create or handle classified 
information to issue regulations 
implementing the Order in final 
form within 180 days of ISOO's 
publication of the government- 
wide implementing directive for 



the Order. Each agency was also 
directed to provide a draft of their 
regulation to ISOO for review prior 
to issuance. Over a period of three 
months the ISOO staff reviewed 
and provided comments on 41 
draft regulations. This was perhaps 
the most fruitful effort of the 
implementation process because it 
gave ISOO the opportunity to point 
out many important requirements 
of the Order that were either 
missing or out of date in the drafts. 

As of March 15, 2011, only 19 of 41 
agencies have issued their imple- 
menting regulations in final form: 
the Departments of Commerce, 
Housing and Urban Development, 
Justice, Labor, Transportation, 
and Veterans Affairs; the Federal 
Communications Commission; the 
Federal Maritime Commission; 
the Federal Reserve System; the 
Federal Trade Commission; the 
General Services Administration; 
the National Archives and Records 
Administration; the Nuclear 
Regulatory Commission; the 
Office of the Director of National 
Intelligence; the Overseas Private 
Investment Corporation; the Small 
Business Administration; the 
Selective Services System; the U.S. 
International Trade Commission; 
and the U.S. Postal Service. The 



Department of Energy has issued 1 
of 3 of its regulations. 

ISOO has stressed to the remaining 
agencies the importance of updated 
regulations, which serve as the 
foundation for the classification 
system. Given that less than half of 
agencies have issued implementing 
regulations in the 15 months since 
the President issued the order and 
the 9 months since ISOO revised 
the government-wide implementing 
regulations for the order, it is clear 
that the means by which agencies 
modify and issue implementing 
regulations are not sufficient to 
accommodate changes in national 
security policy. ISOO sees this 
as the biggest impediment to 
implementing the reforms called 
for by the President and as a real 
threat to the efficient and effective 
implementation of the overall 
classification system. 

Agencies are reminded of the 
need to conduct other actions 
to implement the President's 
direction, the status of which will 
remain a focus of ISOO's oversight 
in FY 2011: 

» Updating component or local 
issuances implementing the 
Order, the Directive, and 
agency-issued regulations. 
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» Updating classification guides 
to include the means by which 
the requirement to incorporate 
original classification decisions 
will be met. 

» Conducting an initial 

"Fundamental Classification 
Guidance Review" under 
section 1.9 of the Order for 
those agencies with original 
classification authority. 

» Updating security education 
and training program content 
and, if appropriate, providing 



required training to original 
classification authorities and 
derivative classifiers. 

» Conducting self-inspections, to 
include the regular review of a 
representative sample of your 
agency's original and derivative 
classification actions. 

» Compliance with section 
5.4(d)(7) of the Order to en- 
sure that personnel that work 
with classified information are 
held accountable. 



» Establishing a secure capa- 
bility to receive information, 
allegations, or complaints 
regarding over-classification 
or incorrect classification and 
to provide guidance to per- 
sonnel on proper classification 
as needed. 

» Updating electronic marking 
tools and document templates 
to reflect changed or new 
requirements, such as the 
identification of persons 
who apply derivative 
classification markings. 
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Classification 



Original Classifiers 

O riginal classification 
authorities, also called 
original classifiers, are those 
individuals designated in 
writing, either by the President, 
by selected agency heads, or 
by designated senior agency 
officials with Top Secret original 
classification authority, to classify 



information in the first instance. 
Only original classifiers are 
authorized to determine what 
information, if disclosed without 
authorization, could reasonably 
be expected to cause damage 
to national security. Original 
classifiers must be able to identify 
or describe the damage. 

In response to the President's 
memorandum of December 



29, 2009, agencies undertook 
a special effort to review their 
delegations of OCA which resulted 
in a reported decrease of 179 
OCAs. The reported number of 
2,378 OCAs in FY 2010 is yet 
another decrease in a downward 
trend, and the lowest number 
to date. In FY 2009, agencies 
reported 2,557 OCAs and in 
FY 2008 this number was 4,109. 



Original Classification Authorities, FY 2010 
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Number of Original Classification Authorities, FY 1980 - FY 2010 
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Classification 



Original Classification 

O riginal classification is an 
initial determination by an 
OCA that information owned 
by, produced by or for, or under 
the control of the United States 
Government requires protection 
because unauthorized disclosure of 
that information reasonably could 



be expected to cause damage 
to national security. In essence, 
these are the only new "secrets." 

The process of original 
classification must always 
include a determination by an 
OCA of the concise reason for 
the classification that falls within 
one or more of the authorized 



categories of classification, the 
placement of markings to identify 
the information as classified, 
and the date or event when the 
information becomes declassified. 
By definition, original classification 
precedes all other aspects of the 
security classification system, 
including derivative classification, 
safeguarding, and declassification. 



Original Classification Activity, FY 2010 
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Original Classification Activity, FY 1989 - FY 2010 
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Classification 



FY 2010 Original Classification 
Activity by Agency 


Department of State 


154,872 


Department of Justice 


47,910 


Department of the Army 


13,057 


Department of Defense 


4,442 


Executive Office of the President 


3,346 


Department of the Air Force 


936 


Department of the Navy 


99 


Department of Homeland Security 


49 


Office of the Director of 
National Intelligence 


8 


Millennium Challenge Corporation 


8 


Central Intelligence Agency 


5 


Department of the Treasury 


1 


Department of Commerce 


1 


Total 


224,734 



Agencies reported 224,734 
original classification decisions 
for FY 2010, which is a 22.6 
percent increase from the 183,224 
decisions reported in FY 2009. 
From FY 1996 through FY 2010, 
the annual average of original 
classification decisions is 212,702. 

Last year, we asked all the 
reporting agencies to either 
start or expand their counting 
of classification decisions in the 
electronic environment and most 
of them were able to comply with 
this request, resulting in a large 
increase in the number of derivative 



decisions reported. This year, 
the new emphasis on counting 
electronic decisions has led to an 
additional increase of reported 
decisions in the original category. 

The large number of original clas- 
sification actions is of concern, 
particularly at the Departments 
of State, Justice, and Army, which 
have consistently reported high 
numbers over time. We question 
whether many of these are truly 
original decisions. From a policy 
perspective, there should be little 
original classification activity 
and agencies should instead be 
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relying upon classification guides. 
The Order now states that all 
original classification decisions 
must be incorporated into clas- 
sification guides. 

For the sixth year in a row, the 
majority of original classification 
decisions were assigned 
declassification dates of ten years 
or less. In FY 2010, the ten-year- 
or-less declassification instruction 
was used 74 percent of the time, 
an increase over the 67 percent 
reported in FY 2009 and the 
highest percentage to date. 

Derivative Classification 

D erivative classification is 
the act of incorporating, 
paraphrasing, restating, 
or generating in new form 
information that is already 
classified and, therefore, are 
not considered new "secrets." 
Information may be derivatively 
classified in two ways: (1) through 
the use of a source document, 
usually correspondence or 
publications generated by an 
OCA; or (2) through the use 
of a classification guide. A 
classification guide is a set of 
instructions issued by an OCA 
which identifies elements of 
information regarding a specific 
subject that must be classified 
and establishes the level and 
duration of classification for each 
such element. 

Derivative classification actions 
utilize information from the 
original category of classification. 



Use of the "Ten-Years-or-Less" Declassification Category 




Since every derivative classifica- 
tion action is based on information 
whose classification has already 
been determined, it is essential 
that the origin of these actions be 
traceable to a decision by an OCA. 

Agencies reported a total of 76.6 
million derivative classification 
decisions in FY 2010. Agencies 
reported 54.7 million derivative 
classification actions in FY 2009, 
and 23.2 million in FY 2008. 
Methods for communicating 
classified information 



electronically have expanded 
significantly, to include classified 
web pages, blogs, wikis, bulletin 
boards, instant messaging, etc. 

In FY 2009, ISOO issued new 
guidance that asked agencies to 
focus on counting classification 
decisions wherever they might 
occur. This naturally led to a 
large reported increase in the 
number of derivative decisions. 
As we explained in our FY 2009 
Annual Report, this was expected 
to have an immediate impact 
and that this number would 



continue to increase as agencies 
continued to refine their ability 
to count in the electronic realm. 
One notable example was the 
Department of State who told 
ISOO last year they would need 
more time to develop their ability 
to count electronic decisions, 
and they have now succeeded 
in doing that for this report. We 
do not expect the reporting in 
this category to stabilize until 
perhaps FY 2011, at which time 
we will hopefully have a new 
baseline for counting. 
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Classification 



Derivative Classification Activity, FY 2010 




In the 1970s , classified products were produced on single pieces of In today's environment , classified products are produced in many 

paper on typewriters. electronic formats. 
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Derivative Classification Activity, FY 1996 - FY 2010 
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Classification 



Combined Original 
and Derivative 
Classification Activity 



T ogether, original and derivative 
classification decisions make 
up the combined classification 
activity. In FY 2010, the reported 



combined classification activity is 
76.8 million decisions, an increase 
of 22 million over the 54.8 million 
decisions reported for FY 2009. 



Combined Original and Derivative Classification Activity, FY 1996 - FY 2010 
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Classification 

Challenges 

C lassification challenges 
provide a mechanism to 
promote sound classification 
decisions. Authorized holders of 
information who, in good faith, 
believe its classification status 
is improper are encouraged 
and expected to challenge the 
classification status of that 



information. Classification 
challenges are handled both 
informally and formally, and 
provide individual holders 
the responsibility to question 
the appropriateness of the 
classification of information. 

ISOO's program reviews have re- 
vealed that many authorized hold- 
ers of classified information are not 
aware of this provision, and there- 
fore, do not challenge classification 



decisions as much as should be 
expected in a robust system. 

Agencies reported 722 formal 
challenges in FY 2010, which is 
a significant increase over the 
356 reported in FY 2009. It was 
also reported that of these 722 
challenges, 84 percent were fully 
affirmed at their current classifica- 
tion status with the remaining 16 
percent being overturned either in 
whole or in part. 
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Declassification 



Background 

D eclassification is defined 
as the authorized change 
in status of information from 
classified to unclassified and is 
an integral part of the security 
classification system. There are 
four declassification programs 
within the Executive branch: 
automatic declassification, 
systematic declassification review, 
discretionary declassification 
review, and mandatory 
declassification review. Automatic 
declassification removes the 



classification of information at 
the close of every calendar year 
when that information reaches 
the 25-year threshold. Systematic 
declassification review is required 
for those records exempted 
from automatic declassification. 
Discretionary declassification 
review is conducted when the 
public interest in disclosure 
outweighs the need for continued 
classification, or when the agency 
feels the information no longer 
requires protection and can be 
declassified earlier. Mandatory 
declassification review provides 



for direct, specific review for 
declassification of information 
when requested. Since 1996, 
statistics reported for systematic 
declassification review and 
automatic declassification were 
combined because the execution 
of both programs is usually 
indistinguishable. This year, 
however, automatic, systematic, 
and discretionary declassification 
numbers were reported separately. 
Together, these four programs 
are essential to the viability of the 
classification system and vital to 
an open government. 



1.46 Billion Pages Declassified, FY 1980 - FY 2010* 




*Excluding Mandatory Declassification Review 
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Pages Reviewed and 
Pages Declassified 

D uring FY 2010, the Executive 
branch reviewed 45.4 
million pages under the automatic 
declassification provisions and 
declassified 24.2 million pages. 



Under systematic declassification 
review, agencies reviewed 5.8 
million pages and declassified 4.6 
million pages. Under discretionary 
declassification review, agencies 
reviewed 1.9 million pages and 
declassified 181,607 pages. A 
total of 53.1 million pages were 



reviewed for declassification and 
29.1 million pages (55.4 percent) 
were declassified. This remains 
consistent with FY 2009 data 
which showed that 52 million 
pages were reviewed and 28.8 
million pages (54.8 percent) 
were declassified. 
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Declassification 



Number of Pages Reviewed and Declassified for Automatic Declassification, FY 2010 
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*Does not include Air Force, Army, and Navy 
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Number of Pages Reviewed and Declassified for Systematic Declassification, FY 2010 




Millions of Pages 

TOTAL: 5,797,022 Pages Reviewed 

4,630,410 Pages Declassified 



*Does not include Air Force, Army, and Navy 



2010 Report to the President 1 17 



Declassification 



Number of Pages Reviewed and Declassified 
for Discretionary Declassification, FY 2010 
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TOTAL: 1,903,832 Pages Reviewed 

181,607 Pages Declassified 



*Does not include Air Force, Army, and Navy 



MDR remains popular with some researchers as 
a less litigious alternative to requests under the 
Freedom of Information Act (FOIA), as amended. 
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Total Number of Pages Reviewed and Declassified,* FY 2004 - FY 2010 
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Mandatory 

Declassification Review 

T he MDR process requires a 
review of specific classified 
national security information in 
response to a request seeking its 
declassification. Requests must be 
in writing and describe the record 
containing the information with 
sufficient specificity to permit the 
agency receiving the request to 
locate it with a reasonable amount 
of effort. MDR remains popular 
with some researchers as a less 



litigious alternative to requests 
under the Freedom of Information 
Act (FOIA), as amended. It is also 
used to seek the declassification of 
Presidential papers or records not 
subject to FOIA. 

Initial Requests 

F rom FY 1996 through FY 2010, 
agencies received an average 
of 4,393 initial requests per fiscal 
year. Agencies received 9,686 initial 
requests for MDR in FY 2010; 1,843 
more than the 7,843 requests 
received in FY 2009. Agencies 



processed 6,726 requests in 
FY 2010, a decrease of 378 
requests from the previous 
fiscal year. The 6,726 requests 
processed in FY 2010 contained 
331,782 pages. Of these, 213,425 
pages were declassified in their 
entirety (64 percent); 96,268 
pages were declassified in part 
(29 percent); and 22,089 pages 
remained classified in their entirety 
(7 percent). 

MDR has proven to be a successful 
program. From FY 1996 through 
FY 2010, agencies received 75,581 
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Declassification 



initial requests and processed 
3,434,105 pages. As a result 
of initial MDR processing, only 
285,418 pages (8 percent) 
remained classified in their entirety 
after an initial MDR review: 
2,147,956 pages were declassified 
in their entirety (63 percent), and 
1,000,731 pages were declassified 
in part (29 percent). 



From FY 1996 through FY 2010, 
agencies carried over an average 
of 3,464 initial MDR requests 
from one fiscal year into the next. 
In FY 2009, agencies reported 
6,582 initial requests carried over 
into FY 2010. This figure increased 
again in FY 2010 as agencies 
reported 9,542 initial requests car- 
ried over into FY 2011, an increase 



of 2,960 from the previous year. In 
FY 2008, three agencies - NARA 
(2,586 requests), Department of 
Defense (DoD) (1,667 requests), 
and the Central Intelligence Agency 
(CIA) (1,063 requests) - accounted 
for the majority of requests carried 
forward into FY 2009. Those same 
agencies account for the major- 
ity of requests carried forward 



MDR Program Activity - Initial Requests 
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into FY 2010 - NARA (2,762), 
DoD (2,165), and CIA (996). The 
same agencies - NARA (5,512), 
DoD (2,210), and CIA (1,100) - 
again account for the majority of 



requests being carried forward 
into FY 2011. The Office of the 
Secretary of Defense (OSD) is 
responsible for the majority of 
requests within DoD, and in 



FY 2011, letters were sent to OSD, 
NARA, and CIA requesting they 
develop a plan to resolve the 
backlog and report quarterly on 
their progress. 



Disposition of MDR Requests, FY 1996 - FY 2010 



Denied: 
285,418 pages 



Declassified in Part: 
1,000,731 pages 




Declassified in 
their Entirety: 
2,147, 956 pages 



TOTAL: 3,434,105 pages 



Appeals 

D uring FY 2010, agencies 
received 302 appeals of 
agency decisions to deny informa- 
tion after processing and deciding 
upon initial MDR requests. Three 
agencies accounted for 85 percent 
of these appeals: CIA (93 appeals, 
31 percent), Air Force (86 appeals, 
28 percent), and DoD (78 appeals, 
26 percent). 



Agencies processed 177 appeals 
in FY 2009, and 231 appeals in 
FY 2010. DoD (83 appeals, 36 
percent), Air Force (82 appeals, 

35 percent), CIA (34 appeals, 

15 percent), and Department 
of State (16 appeals, 7 percent) 
accounted for 93 percent of 
the total appeals processed in 
FY 2010. In FY 2009, agencies 
reported carrying 192 appeals into 
FY 2010. In FY 2010, 8 agencies 



- CIA (130 appeals), NARA (59 
appeals), DoD (42 appeals), State 
(11 appeals), Navy (8 appeals), 
Department of Energy (DOE) (8 
appeals), Air Force (4 appeals), 
and Department of Justice (DOJ) 
(1 appeal) - reported carrying over 
263 appeals into FY 2011. 

Of the 231 appeals processed 
in FY 2010, agencies reviewed 
3,330 pages, a decrease of 3,003 
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Declassification 



from the 6,333 pages reviewed 
in FY 2009. The processing 
of MDR appeals by agencies 
in FY 2010 resulted in the 
declassification of information 
in 2,365 pages; 71 percent of the 
pages reviewed. Of these pages, 



1,308 were declassified in their 
entirety (39 percent) and 1,057 
were declassified in part (32 
percent). Agencies affirmed the 
classification of 965 pages (29 
percent) in their entirety. Since 
FY 1996, agencies processed 



69,885 appealed pages. Of these, 
12,527 pages were declassified 
in their entirety (18 percent); 
29,867 pages were declassified 
in part (43 percent); and 27,491 
pages remained classified in their 
entirety (39 percent). 



Disposition of MDR Appeals, FY 1996 - FY 2010 



Denied: 
27, 491 pages 



Declassified in 




TOTAL: 69,885 pages 



22 | Information Security Oversight Office 



Reviews 



Declassification 

Assessments 

T n FY 2010, ISOO continued an 
initiative begun in FY 2008 to 
evaluate the results of agencies' 
automatic declassification review 
programs. ISOO developed this 
initiative as a means to evaluate 
agency automatic declassification 
review programs, disseminate 
the results to the agencies for 
the purpose of strengthening 
their programs, and inform the 
declassification community as a 
whole by identifying best practices 
and correcting common errors. 
Using Standard Form (SF) 311, 
Agency Security Classification 
Management Program Data, 
submission data from FY 2009, 
ISOO identified 15 agencies whose 
declassification programs were 
substantial enough to warrant 
assessment. Each agency was 
contacted in March 2010 and 
asked to provide information on 
bodies of records for which they 
completed declassification 
reviews during the six month 
period from October 1, 2009, 
through March 31, 2010. ISOO 
analysts used the data collected 
to determine the sample size and 
specific documents to review 
during onsite declassification 
assessments. 

From May through August 2010, 
ISOO analysts conducted on-site 
declassification assessments and 
evaluated the program results 
for each of the 15 agencies. 
Assessments focused on three 
areas of concern: missed equities, 



inappropriate referrals, and 
improper exemptions. A commonly 
missed equity was the mention of 
the security classification interest of 
one agency in the record of another 
agency that had not been identified 
by the initial reviewer for referral to 
that agency. Inappropriate referrals 
denoted occasions when referrals 
were made to agencies that lacked 
the authority to exempt information 
from declassification or had waived 
their interest in the information. 
Improper exemptions included 
instances in which agencies 
attempted to exempt a record from 
automatic declassification under an 
exemption category not permitted 
by that agency's declassification 



guide as approved by ISCAP. The 
occurrence of any of these three 
issues was noted by ISOO analysts 
and factored into the agency score. 
In addition to these three categories 
of findings from within the 
statistical sample, ISOO analysts 
examined records from outside 
the sample in order to develop a 
more complete picture of agencies' 
declassification programs. 

Within the statistical sample, 

ISOO analysts did not encounter 
any examples of missed equities 
and only identified one instance of 
an inappropriate referral. Instances 
of improper exemptions were dis- 
covered in 4 of 15 agency samples. 



Agency 


Result 


Federal Bureau of Investigation 


100 


Joint Staff 


100 


Missile Defense Agency 


100 


National Security Agency 


100 


Office of the Secretary of Defense 


100 


Department of State 


100 


National Geospatial-Intelligence Agency 


98 


Department of the Army 


96 


Defense Intelligence Agency 


90 


Defense Threat Reduction Agency 


90 


National Reconnaissance Office 


88 


U.S. Agency for International 
Development 


80 


Central Intelligence Agency 


76 


Department of the Navy 


76 


Department of the Air Force 


50 
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Reviews 



In evaluating the various pro- 
grammatic aspects of agencies 
automatic declassification review 
programs, ISOO has noted sev- 
eral areas of improvement from 
FY 2008 and FY 2009. Agencies 
are reviewing age-appropriate 
records that are between 20-25 
years of age. Agencies are also 
appropriately using the SF 715, 
Declassification Review Tab, that 
standardizes declassification 
review determinations and helps 
facilitate the processing of refer- 
rals as well as overall archival 
processing. Finally, agencies are 
making more informed referrals. 
ISOO only identified one instance 
of an agency inappropriately 
making a referral based on let- 
terhead instead of the content of 
the information. 

The results of these assess- 
ments were recorded, and scores 
were assigned to the agencies. 



ISOO allocated up to 60 points 
for the objective findings within 
the statistical sample and up to 
40 points for the programmatic 
observations, for a possible total 
of 100 points. Of the 15 agencies 
ISOO assessed, 10 received scores 
of 90 or above, 4 received scores 
from 70 to 89, and 1 received a 
score of 69 or below. ISOO is 
pleased to report that agencies 
continue to show improvement 
in their declassification programs 
since the inception of this program 
in FY 2008. The average score 
increased by over 13 percent, and 
the number of agencies receiving 
scores of 90 or above increased 31 
percent. Additionally, six agencies 
received perfect scores in FY 2010; 
there were no perfect scores in 
FY 2008 and only two in FY 2009. 

ISOO will continue to conduct 
annual assessments, provide 
agency-specific training, and issue 



Security Classification Guides 

Number of 
Guides Not 
Updated 
Within Last 
Five Years: 612 



Number of Security 
Classification Guides: 2,475 



Number of M 
Guides Updated I 
Within Last I 
Five Years: 1,863 ■ 



75 % 



notices to agencies in order to 
provide specific guidance on areas 
of concern they encounter. 

Classification Guides 

T n FY 2010, ISOO revised 
JL the SF 311 and expanded the 
required information to meet 
the reporting requirements of 
the Order. This included a new 
requirement to report on the 
number of security classification 
guides created by each agency. 
Additionally, each agency reports 
the number of guides that had not 
been reviewed or updated within 
the past five years. Agencies 
reported a total of 2,475 security 
classification guides. Of these, 

75 percent (1,863) have been 
reviewed/updated within the 
last 5 years. This is an increase 
from 54 percent in FY 2009 and 
a substantial change from 33 
percent in FY 2008. 

With the issuance of the Order 
and the Directive, agencies with 
original classification authority 
and security classification guides 
were mandated to conduct 
a fundamental classification 
guidance review. The purpose 
of the review is to ensure 
classification guidance reflects 
current circumstances and to 
identify classified information 
that no longer requires protection 
and can be declassified. ISOO will 
continue to provide guidance and 
assistance to the agencies during 
this review process. 
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INTERAGENCY SECURITY 

Classification Appeals panel 



Authority 

S ection 5.3 of Executive Order 
13526, "Classified National 
Security Information." 

Functions 

1. To decide on appeals by 
persons who have filed 
classification challenges under 
section 1.8 of E.0. 13526. 

2. To approve, deny, or amend 
agency exemptions from 
automatic declassification 
as provided in section 3.3 of 
E.0. 13526. 

3. To decide on appeals by 
persons or entities who have 
filed requests for mandatory 
declassification review under 
section 3.5 of E.0. 13526. 

4. To appropriately inform senior 
agency officials and the public 
of final Interagency Security 
Classification Appeals Panel 
(the Panel) decisions on 
appeals under sections 1.8 and 
3.5 of E.0. 13526 

Members* 

William H. Leary, Chair 
National Security Staff 

Mark A. Bradley 
Department of Justice 

Margaret P. Grafeld 
Department of State 



Laurence K. Burgess 
Department of Defense 

Michael J. Kurtz 
National Archives and 
Records Administration 

Corin Stone 

Office of the Director 

of National Intelligence 

Joseph W. Lambert 
Central Intelligence Agency 

Executive Secretary 

William J. Bosanko, Director 
Information Security 
Oversight Office 

Support Staff 

Information Security 
Oversight Office 

Background 

T he Panel was created under 
Presidential executive order 
in 1995 to perform the functions 
noted above and began meeting in 
May 1996. The permanent mem- 
bership is comprised of senior- 
level representatives appointed 
by the Secretaries of State and 
Defense; the Attorney General; the 
Director of National Intelligence; 
the Archivist of the United States; 
and the National Security Advisor. 
Section 5.3(a)(2) of E.0. 13526 
provides for the appointment of 
a temporary representative to 
the Panel from the CIA to par- 
ticipate as a voting member in all 



deliberations and support activities 
that concern classified informa- 
tion originated by the CIA. The 
President selects the Chairperson, 
the Director of the Information 
Security Oversight Office serves as 
its Executive Secretary, and ISOO 
provides staff support. 

Mandatory 
Declassification 
Review Appeals 

D uring FY 2010, the Panel 
allocated a majority of its 
time and resources to processing 
MDR appeals. The documents 
within these MDR appeals came 
before the Panel either classified 
in part or in their entirety and 
were properly filed with the Panel 
in accordance with E.0. 13526 and 
the Panel's bylaws. In FY 2010, 
the members decided on 212 
documents that were appealed 
to the Panel. This is 140 more 
documents than had been decided 
upon in FY 2009, and represents a 
194 percent increase in productiv- 
ity. The Panel declassified ad- 
ditional information in 145 docu- 
ments (68 percent), and affirmed 
the prior agency classification 
decisions in 67 documents (32 
percent). Of the 145 documents in 
which information was declassi- 
fied, 78 documents (54 percent) 
were declassified in their entirety 
and 67 documents (46 percent) 
had some portions declassified 
while the classification of other 
portions was affirmed. 



*Note: The individuals named in this section were in these positions as of the end of FY 2010. 
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S ince May 1996, the Panel has 
decided upon a total of 1,053 
documents. Of these, the Panel 
declassified additional information 
in 65 percent of the documents. 
Specifically, 266 documents (25 
percent) were declassified in 
their entirety and 424 documents 
(40 percent) had some portions 
declassified while the classification 
of other portions was affirmed. 
During this time frame, the Panel 
fully affirmed the classification 
decisions of agencies in 363 docu- 
ments (35 percent). 

Mandatory declassification review 
remains a popular method for 
members of the public as a means 
to request a declassification 
review of specific documents. 

The increasing number of initial 
MDR requests to agencies has 
led to challenges in processing 
MDR cases within the time frames 
outlined in E.0. 13526 and 
32C.F.R. Part 2001. 

Additional information may be 
found on the ISOO website: 

www.archives.gov/isoo/ 

oversight-groups/iscap 

If you have any questions, please 
contact the support staff: 

Telephone: 202.357.5250 
Fax: 202.357.5907 
E-mail: iscap@nara.gov 



ISCAP Decisions, FY 2010 



Affirmed 
Classification: 
67 documents 



Declassified in Part: 
67 documents 




Declassified in 

their Entirety: 78 documents 



TOTAL: 212 documents 



ISCAP Decisions, May 1996 - September 2010 



Affirmed 
Classification: 
363 documents 





TOTAL: 1,053 documents 
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National Industrial 
Security program 



T SOO is responsible for imple- 
menting and overseeing the 
National Industrial Security 
Program (NISP) under E.0. 12829, 
as amended, issued in 1993. This 
oversight responsibility is primar- 
ily executed through the National 
Industrial Security Program Policy 
Advisory Committee (NISPPAC), 
a Federal Advisory Committee 
organized pursuant to section 
103 of E.0. 12829, as amended. 
Membership of the NISPPAC is 
comprised of both Government 
and industry representatives and 
chaired by the Director of ISOO. 

The NISPPAC advises on all 
matters involving the policies 
of the NISP and is responsible 
for recommending changes 
to industrial security policy, 
specifically E.0. 12829, as 
amended, its implementing 
directive (32 C.F.R. Part 2004), 
and the National Industrial Security 
Program Operating Manual 
(NISPOM). The NISPPAC meets at 
the request of the Chairman, but 
at least twice during the calendar 
year, and the meetings are open to 
the public in accordance with the 
Federal Advisory Committee Act. 

During FY 2010, three meetings 
of the NISPPAC were held. The 
following issues were presented 
and discussed: personnel security 
clearance (PCL) processing, 
trust suitability determinations, 
certification and accreditation 
of information systems, foreign 



ownership, control or influence 
of NISP facilities, reporting 
requirements concerning intrusions 
of unclassified information systems, 
status and plan for eliminating non 
GSA-approved security containers, 
industry access to threat data, and 
revisions of the NISPOM and 
32 C.F.R. Part 2004. Additionally, 
the NISPPAC discussed the 
issuance of E.0. 13549, which 
brings the oversight of companies 
that enter into contracts that 
require access to classified 
information with state, local, or 
tribal governments under the NISP. 

The PCL working group 
continued to review and analyze 
a comprehensive set of metrics 
that measure the timeliness of 
PCL processing for industry. This 
analysis resulted in the formation 
of an ad-hoc working group to look 
specifically at the chief causes 
of rejections of PCL requests. 
Preliminary results indicate that 
electronic fingerprinting system 
capability needs to be readily 
available on a cost-effective basis 
to government and industry in 
order to substantially minimize the 
current reject rate. 

The Certification and Accreditation 
(C&A) working group continued 
its review and analysis of the 
process for obtaining approval 
to use classified information 
on information systems. The 
group continues to recommend 
changes to standards and metrics 



With the issuance of E.O. 
13526 and 32 C.F.R. Part 
2001, the need to address 
substantive policy changes 
impacting industry's 
compliance with their 
provisions resulted in an 
effort to revise the NISPOM. 

to improve the timeliness and 
effectiveness of the C&A process 
and to ensure that it is consistent 
with national policy. 

With the issuance of E.O. 13526 
and 32 C.F.R. Part 2001, the need 
to address substantive policy 
changes impacting industry's 
compliance with their provisions 
resulted in an effort to revise 
the NISPOM. To maximize the 
effectiveness of this effort, the 
NISPPAC, working with DoD 
as the NISP executive agent, 
co-directed numerous review 
sessions to ensure industry, the 
Cognizant Security Activities, 
and other affected agencies were 
provided an opportunity to review 
and recommend revisions to 
existing guidelines and proposed 
changes. A revised NISPOM is 
expected to be issued in FY 2011. 
Information on the NISPPAC is 
available on the ISOO website 
(http://www.archives.gov/isoo/ 
oversight-groups/nisppac). 
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Oversight Office 

National Archives Building 
700 Pennsylvania Avenue, NW 
Washington, DC 20408-0001 

Telephone: 202.357.5250 
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E-mail: isoo@nara.gov 
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